7 ms·

Personally I would like to know the exact numbers of e-mails actually sent. Hypothesis out of 1,000 mails: 5% were never read (because of spam filters/whateve

• kbenson 5y ago
  That's one way to look at it. Another is that people spent some time to understand a law which may or may not affect them, but if it does, they should probably already have known about it. "Should" in the sense that it would be good for them it they did, not in the sense that I think they were negligent, as honestly I think there's a bunch of laws that affect people like this that that most of us are unaware of.
  • aero-glide2 5y ago
    I agree, I still don't see what was unethical about this.
    • nickff 5y ago
      How would you feel about getting threatening e-mails out of the blue, then finding out you were being used for the author's personal benefit?
    • bennysomething 5y ago
      I'm assuming you've never had something that approaches a real life legal threat? It's extremely stressful. It's one thing wanting people to know about laws, it's another thing to induce emotional distress just because you think some individual should know. Personally I think it was a horrible thing to do to an innocent person. Totally thoughtless and uncalled for.
    • kbenson 5y ago
      To be clear, I'm not saying the study was conducted ethically, which I think is a complex question (but also one I think influenced quite a bit by the wording of accusations, as "human subject research" has some historical connotations even if an accurate description), but that attributing all lost time/money to a cost the study imposed on others might be taking too much of a leap.
  • matkoniecz 5y ago
    I do not consider acceptable to be threatened about California law that does not apply to me. I do not appreciate learning about any law by being threatened with it in fake spam email. And sending threatening email to humans and having chutzpah to comment "our study does not constitute human subjects research" is just insulting. I received numerous spam from universities about "research" but never one that was blatantly lying, threatening me with inapplicable law and with legal documentation claiming that I am not a human. I send a complaint to them, and will consider further complaining. Does anybody have any idea why it "does not constitute human subjects research"? Is threatening people online not counted because it is online? Or have they lied to review board?
    • jonas21 5y ago
      Even if the California law doesn't apply, if you operate a website with EU citizens as users, you're subject to the GDPR (and unless your website is extremely small or you explicitly block them, you've probably got some users from the EU). The GDPR has similar provisions to the CCPA, and some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Which isn't to say that what the researchers did was acceptable -- just that it can still be a valuable educational experience for anyone unprepared to handle such a request.
      • matkoniecz 5y ago
        > some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Legitimate mails are OK. Mass send spam with illegitimate threats is still not. I am in large part irritated because it gives arguments to people who would want to get rid of such laws, makes harder to handle legitimate requests and spreads false info about such laws. > it can still be a valuable educational experience for anyone unprepared to handle such a request. And being robbed or having your country invaded also can be valuable lesson, which is not making it in any way acceptable or welcome.
      • joecool1029 5y ago
        If they aren't an EU website, GDPR effectively doesn't apply. EU can word the law however they want but at least in the US without a treaty to enforce such a law, it lacks the force of law here. Europeans have an extremely hard time understanding this and I'm not quite sure why. I see this assertion again and again across the web.
  • karaterobot 5y ago
    With respect, it just doesn't matter whether you think the researchers were doing a service or not. What I mean is, the researchers are (depending on jurisdiction and funding source) bound to abide by certain standards when doing human subjects research, and informed consent for participation is one of those standards. Even if receiving the email was 100% beneficial to everybody, and had no risks at all, the participants would still need to been told about those benefits before participating. They get to make the choice to participate or not. The IRB process exists to make sure those practices are followed in every case, to take the personal opinion of a researcher out of it. These standards were developed in response to researchers who did very harmful things to subjects without their consent, in many cases because they thought it was for the greater good.
    • kbenson 5y ago
      > With respect, it just doesn't matter whether you think the researchers were doing a service or not. I wasn't making a case that the study was fine and had no problems. I was making a comment on, broadly, "money wasted because of this". Whether the study was problematic or not (it seems like it was), everyone scared by this email was only scared because they'd stuck their head in the sand with regard to laws that have been enacted that put certain requirements on some people, and whether they are affected or not. As I see it, there are a few possible general outcomes of the email: One, you know what your requirements are, if any, and you respond appropriately. Two, you don't know what your requirements are, and you look up your requirements, and respond or take further action at that time. For the majority of people, that fall into this case, that's probably "do nothing". Three, you don't know, go immediately to a lawyer, and burn a lot of time and money with that lawyer, for them to either tell you it doesn't affect you or to ask you WTF you're doing operating something like you are without knowing the simplest of things that could affect you. In all those cases, you are left off either with the same or more knowledge about your legal responsibilities online. In the cases where you waste resources using a lawyer (in some cases a lawyer would not be a waste, but possibly something you should have done previously), I think that's people overreacting to their own (possibly longstanding) negligence in understanding their own situation. For what it's worth, whether the study was conducting in a way that was acceptable is irrelevant this specific question. Any individual could email asking a similar question entirely legitimately.
• pessimizer 5y ago
  I'm shocked that your hypothesis assigns 0% to "Admin spent 30 seconds pasting a form letter, or a link to a page on the site, that describes their handling of user info and the process for deleting or requesting it."
  • matkoniecz 5y ago
    Presumably this focuses on experience of operators of small hobby websites. Which do not have dedicated admins or form letter prepared by legal department.
  • sokoloff 5y ago
    Even if that material was pre-prepared, there's vanishingly few (probably zero) organizations for whom 30 seconds of one IT admin's time, acting alone, would be spent on this. "Oh shit, we need to have at least a phone call with counsel on this before we reply at all!"
  • jaclaz 5y ago
    I think you can un-shock yourself. The mail sent to a "random/generic" address (let's say info@nicesite.com, provided that the site is large enough to have a permanent site admin) would be read by a low level support person, that would forward it to a manager, which would forward it to a higher level manager that would forward it, after having discussed it, to the site admin. The 30 seconds is totally unreal, let's make it 5 minutes, but these five minutes are spent after another 20 minutes of internal moving/talks before it gets to the site admin. So my half hour at 40 US$ may become 20 minutes at US$ 40 and 5 minutes at US$ 120 40/3+120/20=19,33, not far from the 20 dollars attributed to 50% of cases.
• hapanin 5y ago
  Perhaps the lab (and the IRB) should collectively perform 750h community service.
  • ad404b8a372f2b9 5y ago
    At the rates phd students get payed they basically already are.
  • jaclaz 5y ago
    ... for each 1,000 mails sent, heck, seemingly they sent 200-300,000 of them!
• deleted 5y ago
  [deleted]
• alistairSH 5y ago
  $40/hour? That seems super low, unless all the emails were processed by mid-level admins. If a web admin, engineer, etc processed it, you probably need to double that. If it went to counsel, the value could be tripled or more.
  • dr_dshiv 5y ago
    God, think of how expensive the internet is, in human time costs.
• belorn 5y ago
  From work experience, only a small amount of website contact information work to actually contact the person in charge of the website. My very rough estimated would put it more like: 40% of email addresses is no longer valid or has an mail box that does not get read. 30% reaches the web design shop which built the website many years ago under a different brand. They blindly forward it to their customer if they still have that information. The contact information is many years old and likely a dead end. 20% has auto-reply and do not get read. 1-2% has algorithmic reply that links to a FAQ. 5% actually reach a human being. Those 5% however are still a good enough reason to not do this!
• williamstein 5y ago
  I suspect it was far more than 1000 emails, because my small company got one. It scared us and wasted significant time (eg as we carefully read the relevant CA law). At the time we concluded that it was highly likely to be a phishing scam and archived the message with no response. In addition we decided not to respond because the person asking the question was not a paying customer. I definitely did feel threatened by the way the email was worded.
  • pksebben 5y ago
    I would be fascinated to read the original copy. there's a lot of information missing in this story.
    • javajosh 5y ago
      Apparently this was the last line, as reported by the honeypot blogger: "I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code."
    • lethologica 5y ago
      The mail reads: To Whom It May Concern: My name is … , and I am a resident of Paris, France. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests: Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to? What personal information do I have to submit for you to verify and process a GDPR data access request? What information do you provide in response to a GDPR data access request? To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request. Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding zylstra.org, I kindly ask that you forward my request to them. I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR. Sincerely,
      • tdeck 5y ago